Microsoft Entra B2B: Gmail guest invitation redemption with built-in Google federation fails with AADSTS165000

Question

Microsoft Entra B2B: Gmail guest invitation redemption with built-in Google federation fails with AADSTS165000

Ilyass Krichi 5

We are troubleshooting Microsoft Entra External ID B2B collaboration with the built-in Google identity provider. Gmail guests cannot redeem B2B invitations. The redemption flow fails with AADSTS165000 before the user is redirected to the target app.

Service/scenario: Microsoft Entra workforce tenant B2B collaboration Built-in Google identity provider for external users Guest invitation redemption for Gmail users Microsoft Graph POST /invitations and official Microsoft invitation email

Error: AADSTS165000: Invalid Request: The request did not include the required tokens for the user context. One or more of the user context values (cookies; form fields; headers) were not supplied, every request must include these values and maintain them across a complete single user flow. Failure Reasons:[Token was not provided;]

Example diagnostic values: Request ID: bef43cf8-146e-4a07-b243-f69ca8bb0300 Correlation ID: 5ea2cd53-f456-4741-ac42-ed59721f7dd2 Timestamp UTC: 2026-05-05T16:02:44Z

Observed flow:

User opens Microsoft B2B invitation redemption link.
Browser reaches invitations.microsoft.com / login.microsoftonline.com.
Microsoft redirects to Google OAuth.
Google auth request uses: response_type=code response_mode=form_post scope=openid email profile address redirect_uri=https://login.microsoftonline.com/tenant-id/federation/oauth2
Browser returns to: https://login.microsoftonline.com/tenant-id/federation/oauth2
Microsoft shows AADSTS165000.

What works: Normal sign-in through the main sign-in screen with the same built-in Google provider works and reaches Google consent.

What fails: Raw Graph inviteRedeemUrl fails. Official Microsoft invitation email link fails. A brand-new Gmail user on another computer fails. Fresh Chrome profile using --user-data-dir fails. The failure happens before redirecting to our app.

Configuration already checked:

Built-in Google provider is configured under External Identities ** All identity providers ** Google.
It is not a custom OIDC provider.
Google client ID in Entra matches the client_id in the captured Google authorize URL.
Google client secret was rotated and updated in Entra.
Google OAuth consent screen is in Production.
Authorized domain includes microsoftonline.com.
Earlier Google redirect_uri_mismatch was fixed by adding: https://login.microsoftonline.com/tenant-id/federation/oauth2
Also tested a clean Google OAuth client with only workforce/B2B redirect URIs: https://login.microsoftonline.com https://login.microsoftonline.com/te/tenant-id/oauth2/authresp https://login.microsoftonline.com/te/tenant-domain/oauth2/authresp https://login.microsoftonline.com/tenant-id/federation/oauth2 https://login.microsoftonline.com/tenant-domain/federation/oauth2
Cross-tenant access inbound/outbound is allowed.
Guest invitations are allowed.
Identity provider precedence is: azureActiveDirectory, externalFederation, socialIdentityProviders
fallbackIdentityProvider is defaultConfiguredIdp.
No shadow/custom OIDC provider was found.

Invitation payload tested: POST https://graph.microsoft.com/v1.0/invitations

{ "invitedUserEmailAddress": "gmail-user", "invitedUserDisplayName": "Test User", "inviteRedirectUrl": "https://myapps.microsoft.com", "sendInvitationMessage": true }

Also tested sendInvitationMessage=false and opening returned inviteRedeemUrl directly.

Question: Why does the B2B invitation redemption path fail with AADSTS165000 when normal Google sign-in works with the same built-in Google provider? Is there a tenant-level setting, Google provider object issue, or known Microsoft Entra invitation redemption issue that can cause the federation callback to lose or reject the required token/session context?

VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-05-06T15:25:28.5366667+00:00

Hello Ilyass Krichi,

Thank you for the detailed information provided. Based on the findings, the built‑in Google identity provider configuration is working as expected, since normal Google sign‑in succeeds. The issue is isolated to the B2B invitation redemption flow, which is failing with AADSTS165000 during the callback to …/federation/oauth2.

Root cause:

AADSTS165000 indicates that Microsoft Entra is not receiving or is rejecting the required session/state context during invitation redemption. This flow is more state‑sensitive than a normal sign‑in. If the Entra session cookies or POST context are lost between the invitation link and the Google callback, redemption fails even though Google authentication completes successfully.

Solution:

Ensure the invitation link is opened in a full system browser (Chrome/Edge) and not from Outlook, Teams, or any embedded/in‑app browser.

Test from a clean network (no proxy, SSL inspection, mail‑link rewriting, or security filtering).

Capture a HAR trace and verify that Entra session/context cookies are present on the POST request to /federation/oauth2.

If the issue persists please let me know.
Ilyass Krichi 5 Reputation points

2026-05-06T15:43:02.7666667+00:00
Hello @VEMULA SRISAI , thanks for the quick answer.

I captured the HAR from a full Chrome system browser clean profile.

The final Google callback to Entra is present:

POST https://login.microsoftonline.com/89799c73-e5b4-4198-bd3e-7a7b16507f13/federation/oauth2

Status: 200

Content-Type: application/x-www-form-urlencoded

Origin: https://accounts.google.com

The POST body includes:

state: present

iss: https://accounts.google.com

code: present

scope: present

authuser: 0

prompt: none

Chrome DevTools showed the Cookie header present on this request, including Entra cookies such as esctx, stsservicecookie, buid, and fpc. The exported HAR appears to omit cookies.

The Entra response is an HTML error page with:

x-ms-request-id: 595928ac-f6ad-470d-9d53-8cd58d640500

x-ms-ests-server: 2.1.24202.3 - SEC ProdSlices

Error shown to user: AADSTS165000 Token was not provided.
Ilyass Krichi 5 Reputation points

2026-05-06T16:44:17.8433333+00:00

I would like to add a note: We are using a tenant with type External for Entra ID, maybe this is the cause?
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-05-21T09:39:01.36+00:00
Ilyass Krichi ,Thank you for sharing the HAR details — this helps a lot.

Since the Google callback is returning correctly (with code, state, and cookies present), this confirms the Google federation itself is working. The failure at /federation/oauth2 with AADSTS165000 indicates that the issue is occurring when Entra tries to reconstruct the invitation redemption session.

In the B2B redemption flow, Entra must maintain and validate the full invite context (including the invitation state and correlation to the pending guest object) across all redirects. If that context cannot be matched at the time of the federation callback, the request is rejected with this error, even if the OAuth response from Google is valid.

Given that:

The issue reproduces across clean browsers/devices

Cookies and POST parameters are present

Normal Google sign‑in works

this behavior is not consistent with a client-side or Google configuration issue.

Also, your note that this is an External (CIAM) tenant is relevant. We have seen cases where B2B invitation redemption combined with social providers (like Google) does not successfully maintain or correlate the session context in this flow, even though standard sign-in works as expected.Recommendation

To further isolate:

Enable Email OTP (if not already enabled) and test redemption

Try redeeming after removing and re-inviting the guest user
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-05-22T15:10:09.9733333+00:00

Ilyass Krichi ,I’m following up on my previous comment as I haven’t received a response. Please let me know if you need any additional information or assistance from my side.

Your answer

VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-05-06T15:25:28.5366667+00:00

Hello Ilyass Krichi,

Thank you for the detailed information provided. Based on the findings, the built‑in Google identity provider configuration is working as expected, since normal Google sign‑in succeeds. The issue is isolated to the B2B invitation redemption flow, which is failing with AADSTS165000 during the callback to …/federation/oauth2.

Root cause:

AADSTS165000 indicates that Microsoft Entra is not receiving or is rejecting the required session/state context during invitation redemption. This flow is more state‑sensitive than a normal sign‑in. If the Entra session cookies or POST context are lost between the invitation link and the Google callback, redemption fails even though Google authentication completes successfully.

Solution:

Ensure the invitation link is opened in a full system browser (Chrome/Edge) and not from Outlook, Teams, or any embedded/in‑app browser.

Test from a clean network (no proxy, SSL inspection, mail‑link rewriting, or security filtering).

Capture a HAR trace and verify that Entra session/context cookies are present on the POST request to /federation/oauth2.

If the issue persists please let me know.
Ilyass Krichi 5 Reputation points

2026-05-06T15:43:02.7666667+00:00

Hello @VEMULA SRISAI , thanks for the quick answer.

I captured the HAR from a full Chrome system browser clean profile.

The final Google callback to Entra is present:

POST https://login.microsoftonline.com/89799c73-e5b4-4198-bd3e-7a7b16507f13/federation/oauth2

Status: 200

Content-Type: application/x-www-form-urlencoded

Origin: https://accounts.google.com

The POST body includes:

state: present

iss: https://accounts.google.com

code: present

scope: present

authuser: 0

prompt: none

Chrome DevTools showed the Cookie header present on this request, including Entra cookies such as esctx, stsservicecookie, buid, and fpc. The exported HAR appears to omit cookies.

The Entra response is an HTML error page with:

x-ms-request-id: 595928ac-f6ad-470d-9d53-8cd58d640500

x-ms-ests-server: 2.1.24202.3 - SEC ProdSlices

Error shown to user: AADSTS165000 Token was not provided.
Ilyass Krichi 5 Reputation points

2026-05-06T16:44:17.8433333+00:00

I would like to add a note: We are using a tenant with type External for Entra ID, maybe this is the cause?
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-05-21T09:39:01.36+00:00

Ilyass Krichi ,Thank you for sharing the HAR details — this helps a lot.

Since the Google callback is returning correctly (with code, state, and cookies present), this confirms the Google federation itself is working. The failure at /federation/oauth2 with AADSTS165000 indicates that the issue is occurring when Entra tries to reconstruct the invitation redemption session.

In the B2B redemption flow, Entra must maintain and validate the full invite context (including the invitation state and correlation to the pending guest object) across all redirects. If that context cannot be matched at the time of the federation callback, the request is rejected with this error, even if the OAuth response from Google is valid.

Given that:

The issue reproduces across clean browsers/devices

Cookies and POST parameters are present

Normal Google sign‑in works

this behavior is not consistent with a client-side or Google configuration issue.

Also, your note that this is an External (CIAM) tenant is relevant. We have seen cases where B2B invitation redemption combined with social providers (like Google) does not successfully maintain or correlate the session context in this flow, even though standard sign-in works as expected.Recommendation

To further isolate:

Enable Email OTP (if not already enabled) and test redemption

Try redeeming after removing and re-inviting the guest user
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-05-22T15:10:09.9733333+00:00

Ilyass Krichi ,I’m following up on my previous comment as I haven’t received a response. Please let me know if you need any additional information or assistance from my side.